UK Bespoke Shutter Company is committed to protecting personal data and respecting the privacy rights of customers, prospective customers, employees, contractors, suppliers and other individuals whose information we process.
This GDPR Policy explains how we manage personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.
1. Purpose of This GDPR Policy
This policy sets out how UK Bespoke Shutter Company collects, processes, stores, protects and disposes of personal data.
We process personal data lawfully, fairly and transparently because individuals have a right to understand how organisations use information about them.
This policy applies to personal data processed through our website and during our day-to-day business activities.
2. Who Is Responsible for Data Protection?
UK Bespoke Shutter Company acts as a data controller when it determines how and why personal data is processed.
Questions about data protection or requests concerning personal data should be sent using these contact details.
3. What Is Personal Data?
Personal data is information relating to an identified or identifiable individual.
Personal data we process may include:
Names.
Home or business addresses.
Email addresses.
Telephone numbers.
Property addresses.
Postcodes.
Business and company information relating to identifiable individuals.
Customer enquiry information.
Quotations and order information.
Appointment and site survey information.
Invoices and payment records.
Correspondence.
Complaint records.
Website usage and technical information.
Other information provided when contacting or working with us.
We only collect personal data that is reasonably necessary for a legitimate business or legal purpose.
4. Data Protection Principles
UK Bespoke Shutter Company processes personal data according to the principles established by the UK GDPR.
Personal data must be:
Processed lawfully, fairly and transparently.
Collected for specified, explicit and legitimate purposes.
Adequate, relevant and limited to what is necessary.
Accurate and kept up to date where necessary.
Retained only for as long as necessary.
Processed securely.
We are also responsible for demonstrating compliance with these principles.
5. How Do We Collect Personal Data?
We may collect personal data when an individual:
Contacts us by telephone or email.
Completes a website contact form.
Requests a quotation.
Arranges a consultation or site survey.
Places an order.
Uses our installation, repair or maintenance services.
Makes a payment.
Submits a complaint or query.
Communicates with our employees or contractors.
Applies for employment or work with us.
Supplies products or services to our business.
Certain technical information may also be collected when visitors use our website.
6. Why Do We Process Personal Data?
We process personal data where there is a clear business, contractual or legal reason for doing so.
This may include:
Responding to enquiries.
Preparing quotations.
Arranging site surveys.
Processing orders.
Installing shutters, doors and shopfronts.
Providing repair and maintenance services.
Managing customer relationships.
Scheduling appointments.
Processing and recording payments.
Managing suppliers and contractors.
Maintaining financial and business records.
Handling complaints.
Protecting our legal rights.
Meeting regulatory, tax and accounting obligations.
Operating and improving our website.
Protecting our website and systems against misuse.
Sending marketing communications where permitted.
We do not process personal data for purposes that are incompatible with the reason it was originally collected unless permitted by law.
7. Lawful Bases for Processing
We must have a lawful basis before processing personal data.
Depending on the circumstances, we may rely on:
Contract
We process personal data where it is necessary to take steps before entering into a contract or to fulfil our contractual obligations.
For example, we need customer contact and property information to prepare quotations, arrange installations and provide repair services.
Legal Obligation
We may process information when necessary to comply with legal obligations, including accounting, tax and regulatory requirements.
Legitimate Interests
We may process personal data where it is necessary for our legitimate business interests and those interests do not override the individual's rights and freedoms.
This may include managing customer relationships, protecting our business, responding to enquiries and improving our services.
Consent
We may rely on consent where appropriate.
When processing relies on consent, individuals can withdraw their consent at any time.
8. Special Category Personal Data
Certain information receives additional protection under UK data protection law. This includes information concerning health, racial or ethnic origin, religious beliefs and other categories defined by the UK GDPR.
UK Bespoke Shutter Company does not routinely require special category personal data to provide shutter and shopfront services.
If we need to process this type of information, we will ensure an appropriate lawful basis and additional condition for processing applies.
9. Data Minimisation
We only collect personal data that is relevant and reasonably necessary.
Employees and contractors handling personal data should avoid collecting unnecessary information because holding excessive personal data increases privacy and security risks.
Where information is no longer required, it should be deleted or securely disposed of in accordance with our retention requirements.
10. Accuracy of Personal Data
We take reasonable steps to ensure personal data remains accurate and up to date.
Individuals should inform us if their personal information changes or they believe information we hold is inaccurate.
Where we identify inaccurate information, we will correct or update it where appropriate.
11. How Do We Protect Personal Data?
UK Bespoke Shutter Company takes appropriate technical and organisational measures to protect personal data.
Measures may include:
Password protection.
Appropriate access controls.
Secure devices and systems.
Appropriate backup procedures.
Restricting access to personal information.
Secure storage of business records.
Appropriate disposal of confidential information.
Keeping software and systems appropriately maintained.
Staff awareness of data protection responsibilities.
Access to personal data should only be provided to individuals who reasonably require it to perform their duties.
12. Sharing Personal Data
We do not sell personal data.
We may share information with third parties where reasonably necessary to operate our business, provide services or comply with legal requirements.
Recipients may include:
Contractors and installers.
Product suppliers.
IT providers.
Website hosting providers.
Email and communication providers.
Payment providers.
Accountants.
Legal advisers.
Insurers.
Professional advisers.
Government authorities.
Regulators.
Courts or law enforcement authorities where legally required.
Where another organisation processes personal data on our behalf, appropriate data protection arrangements should be in place where required.
13. International Data Transfers
Some technology or service providers may process personal data outside the United Kingdom.
Where personal data is transferred internationally, UK Bespoke Shutter Company will take appropriate steps to ensure the transfer complies with UK data protection requirements.
Appropriate safeguards may include UK adequacy regulations or recognised contractual safeguards.
14. How Long Do We Keep Personal Data?
We do not retain personal data indefinitely.
Retention periods depend on the reason the information was collected and any legal requirements that apply.
Customer and transaction information may need to be retained after work has been completed because records can be required for accounting, tax, contractual, warranty or legal purposes.
Enquiry information that does not result in a contract may be retained for a shorter period.
When personal data is no longer reasonably required, it should be securely deleted, destroyed or anonymised.
15. Individual Data Protection Rights
Depending on the circumstances, individuals have rights concerning their personal data.
These may include the right to:
Access personal data held about them.
Request correction of inaccurate information.
Request deletion of personal data in certain circumstances.
Request restriction of processing.
Object to certain processing.
Request data portability where applicable.
Withdraw consent where processing relies on consent.
Raise a complaint about the use of their personal data.
These rights are subject to conditions and exemptions under data protection law.
16. Subject Access Requests
Individuals can ask for access to personal data UK Bespoke Shutter Company holds about them.
We may request information to confirm the identity of the person making the request because personal data must not be disclosed to an unauthorised individual.
We will respond within the applicable statutory timeframe.
17. Data Erasure Requests
Individuals may have the right to ask us to delete personal data in certain circumstances.
The right to deletion is not absolute.
We may need to retain certain information where continued processing is required for legal, contractual, accounting or other legitimate purposes permitted by law.
We will consider each request according to applicable data protection requirements.
18. Data Breaches
A personal data breach can include accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.
Anyone working for or on behalf of UK Bespoke Shutter Company should report a suspected personal data breach promptly.
We will assess the nature and potential consequences of the breach.
Where required by law, we will notify the Information Commissioner's Office within the applicable timeframe. Where a breach is likely to result in a high risk to affected individuals, we will also inform those individuals where required.
19. Marketing
We will only use personal data for direct marketing where we have an appropriate lawful basis and comply with applicable electronic marketing requirements.
Individuals can ask us to stop sending direct marketing communications at any time.
Opting out of marketing does not prevent us from sending necessary communications about quotations, orders, appointments, invoices or existing services.
20. Cookies and Online Tracking
Our website may use cookies and similar technologies.
Essential cookies may be required for the website to operate correctly.
Where consent is legally required for analytics, advertising or other non-essential cookies, those technologies should not be activated until the appropriate consent has been obtained.
Visitors should be able to manage applicable cookie preferences through the website's cookie controls.
Further details should be provided through our Cookie Policy where applicable.
21. Employees and Contractors
Employees, contractors and anyone working on behalf of UK Bespoke Shutter Company must handle personal data responsibly.
Personal information should only be accessed where necessary for legitimate work purposes.
Personal data must not be disclosed to unauthorised individuals or used for personal purposes.
Any suspected loss, misuse or unauthorised disclosure of personal information should be reported promptly.
22. Third-Party Data Processors
Where we appoint third parties to process personal data on our behalf, we will take reasonable steps to ensure they provide appropriate protection.
Where required by the UK GDPR, appropriate contractual arrangements will govern how processors handle personal data.
Processors should only use personal data according to our documented instructions unless otherwise required by law.
23. Data Protection by Design
We consider privacy and data protection when introducing new systems, services or processes involving personal information.
Where processing is likely to create a high risk to individuals, we will consider whether a Data Protection Impact Assessment is required before the processing begins.
This approach reduces privacy risks because potential issues can be identified before personal information is processed.
24. Complaints
Anyone concerned about how UK Bespoke Shutter Company processes their personal data should contact us first.
We will investigate data protection concerns and respond appropriately.
Individuals also have the right to complain to the Information Commissioner's Office, the UK's independent data protection regulator.
Information Commissioner's Office
25. Review of This GDPR Policy
We will review this policy periodically and update it when our processing activities, business practices or applicable legal requirements change.
The latest version should be made available to relevant employees, contractors and other parties where appropriate.
26. Contact UK Bespoke Shutter Company
For questions about this GDPR Policy, requests concerning personal data or data protection complaints, contact: